A Study of Forensic Imaging to Evaluate "Unsanitized" Destination Storage Media

Abstract

Best practices in digital forensics include a procedure to sanitize media on which forensic images will be stored, thus eliminating potential challenges that contamination of the evidence may occur due to data that exist on the media prior to storing forensic images. This article describes a research project to empirically evaluate the extent to which wiping destination storage media affects evidence. The authors specifically address whether the contents of forensic images differ in any way when written to a freshly wiped and formatted medium when compared to the images being written to a similar medium that had been populated with data and not wiped. They performed these experiments on different types of storage devices.